JP2012510650A - Protecting virtual guest machines from attacks by infected hosts - Google Patents

Abstract

  In the virtual environment (100), the host machine (210) on which the guest machine (205) can be operated (update the current security patch, execute the anti-virus program, execute the guest machine) Malicious software or malware that may be healthy by complying with applicable policies (such as being authenticated) and that may disrupt or compromise the security of the guest machine (205) Monitored to determine if it is free from malware). When it is discovered that the host machine (210) is not compliant, the guest machine (205) is prevented from being started on the host machine (210) or connected to the network (223), and virtualized. The entire environment (100) is compliant, and the guest machine (205) containing data, applications, etc. is passed through malicious code running on an unhealthy host machine (210) It is protected against attacks that could be launched against it, or it is guaranteed to be isolated from the network (223) until it can correct the non-compliance.

Description

  Virtualization is an important strategy with a wide range of implications that make information technology (IT) infrastructure more effective and efficient available by isolating or isolating one computing resource from another. This strategy may be applied to all layers of computing stacks from the data center to the desktop. Rather than locking various layers together as is typical in a static computing environment, OS (Operating System) to hardware, applications to OS, and user interface to local computing devices, virtual The aim is to eliminate the direct dependence of these parts on each other.

  Such data center to desktop virtualization allows new capabilities to be deployed quickly without acquiring new hardware or configuration components. Test requirements and application compatibility issues are reduced, automated processing is simplified, and failure recovery performance is easier to implement. Virtualization on the desktop helps customers or company employees create an infrastructure that allows them to access the required applications wherever they are located. For example, a user can use a host machine from virtually any location, using virtualization products and technologies to implement guest machines, and all of their application, data, configuration and priority performance Access your personalized desktop.

  This background is provided to provide a brief background of the detailed description and overview that follows. This background art is not intended to be considered in determining the scope of the claimed subject matter and is viewed as limiting the claimed subject matter to solve any or all of the above disadvantages or problems. It is not intended to be.

  In a virtualized environment, guest machines can operate on unhealthy infected host machines, and the threats of guest machines being attacked by host machines are (update current security patches Whether it is healthy by complying with applicable policies (such as running anti-virus programs, authenticating to run guest machines, etc.) and can interfere with or compromise the guest machine's security The host machine is addressed by the monitored organization to determine if it is free from sexual malicious software or malware. If the host machine is found to be non-compliant, it prevents either the guest machine from booting on the host machine or connecting to the network, the entire virtualization environment is compliant, and data and applications Etc. are protected or compliant with attacks that could be launched against malicious code running on unhealthy host machines. Ensure that you are isolated from the network until you can fix it.

  In various illustrative examples, a guest health agent running on a guest machine checks host compliance with one or more compliance policies stored on the guest or received from a compliance policy server. Configured to communicate with the host health agent on the host machine during the guest boot process. If it finds that the host machine is not compliant, it can fix the host machine's non-compliance, as the guest machine may display an error message to the user. For example, by installing appropriate patches, removing anti-virus applications or updates, etc. If the host machine is already compliant, or after it has been modified to be compliant, the guest machine can complete the boot process to achieve a virtualized environment, and the user's desktop, application and The data will be available on the guest machine.

  The compliance state of the host machine may be checked periodically after the virtualization environment is initialized and operational. For example, if a guest machine attempts to connect to a network, such as a corporate or corporate network, the guest health agent may request a declaration of compliance from the host health agent indicating the current health of the host machine. Declares compliance by the guest health agent at the remote policy enforcement point on the network to verify host machine compliance with one or more policies requested by the enforcement point before network access is granted Can be transferred. If the declaration of compliance indicates that the host machine does not comply with applicable policies (this indicates that the host is at risk and has a high probability of being infected and / or compromised by malware) Network access is denied. The user may be provided with an error message, which may correct the non-compliance before attempting network access again.

  In another example of a host machine health check, the guest health agent may verify and / or confirm continued compliance with applicable policies if there is a suspicion that the integrity of the virtualization environment has been compromised. May require a declaration of compliance from the host health agent. For example, a security assessment under an Enterprise Security Assessment Sharing (ESAS) security model may be received at an endpoint (ie, a security gateway device) that is organized to monitor security related information in the network. This received security assessment can cause suspicion that the virtualization environment is compromised. This declaration of compliance can be used to determine whether a security incident involving the host machine has occurred to confirm or reject the suspicion, or to trigger further analysis of the host. If it is confirmed that the host machine has been compromised, operations on the guest machine may be interrupted and network connection requests may be denied until the security incident involving the host machine is addressed and corrected. There is.

  Advantageously, the current organization for protecting guest machines against attacks from malware on the host allows for increased security in a virtualized environment. While the basic virtualization essence of computing resource isolation is preserved, guest machine and host machine security analysis is tied to the purpose of checking and enhancing host machine compliance with applicable policies.

  This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the detailed description. This summary is not intended to identify key features or important features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.

It is a figure which shows the structure of the virtualization which can be operated on a host machine. It is a figure which shows the virtualization environment which a guest machine can operate on the host machine which has connection to a network. It is a figure which shows the component which can be operated on a guest machine and a host machine. FIG. 5 shows a flowchart of a first exemplary usage scenario in which the health of the host machine is checked at guest machine startup. FIG. 6 shows a flowchart of a second exemplary application scenario where the health of the host machine is periodically checked. FIG. 6 illustrates an example ESAS provided to enable security assessments where a channel is shared among multiple endpoints. FIG. 6 illustrates an example scenario used to cause a host machine compliance check in a policy to which a security assessment is applicable.

  In the drawings, like reference numbers indicate like elements.

  Virtualization is a disruptive technology that has dramatically changed computing today in many ways. For example, virtualization avoids users (ie consumer company employees or business users) having to carry their own laptop computer when they leave their desktop PC (Personal Computer). Enable. Instead, they can carry their desktop images on a portable storage device, such as a USB (Universal Serial Bus) drive, and are publicly accessible at home PCs, hotel kiosks, airports, libraries or cyber cafes. The desktop can run as a virtual guest on any host computer, such as a possible PC, a friend's home computer, etc.

A virtual environment can be set up on the host machine 100 such as a PC by creating a plurality of isolated logical units called partitions executed by the host and one or more guest machine operating systems. As shown in FIG. 1, the virtualization environment 102 typically includes a root partition 106 that may be used to create one or more child partitions 110 _{1... N} that support guest machines. In some cases, a child partition can also generate its own further child partitions. The root partition 106 contains the operating system for the host machine and has direct access to the host hardware, including the central processing unit, memory and other hardware resources.

  The virtualization software layer 116 is organized between the partitions and the hardware 120 on the host machine. In this example, the virtualization software includes a hypervisor that shows the child partition 110 a virtual view of the hardware 120 on the logical channel in this layer 116 that supports communication between partitions. Requests from the guest machine to the virtual hardware are directed to the parent or root partition on the logical channel. The root partition will then manage the request and return a response on the channel. The entire request and response process is completely apparent to the operating system running on the guest machine.

  While virtualization performs well and provides considerable flexibility and economic value, there are potential security threats when the host machine is infected with malware such as viruses, Trojan horses, keyloggers and the like. When a guest machine is started on a child partition 110, malware on the host may be provided with an opportunity to steal or tamper with data on the guest. Furthermore, if the guest machine is used to access a network such as a remote corporate network, the malware may gain unauthorized access to resources and data on the network via the guest machine.

  Security solutions such as NAP / NAC (Network Access Protection / Control) can be used to check the health of guest machines by verifying that they conform to a given compliance policy. For example, a policy might be that a guest machine is fully updated with recent security patches, has an up-to-date signature, has an anti-virus or anti-malware software program running, and is properly configured. There is a possibility of specifying having a firewall. However, current solutions perform compliance checks only for guest machines and ignore the health of the host machine. Thus, even when the guest machine is found to be fully compliant and healthy, current solutions do not address the exposure of the guest machine to malware that may reside on the host machine.

  FIG. 2 illustrates an example virtualization environment 200 in which current arrangements for protecting guest machines from attacks by infected hosts may be implemented. The virtual guest machine 205 can be operated on a host machine 210 such as a PC having a connection 215 to a network such as a remote company network 223 (corponet). Network connection 215 is one of a variety of remote networking protocols including, for example, VPN (Virtual Private Network), SSL (Secure Sockets Laer) based VPN, VPN over IPSec (Internet Protocol Security over VPN), and the like. Can be implemented using one. Alternatively, the network connection 215 is, for example, owned by the assignee of the present application on June 29, 2008 under the title “Globally Distributed Infrastructure for Secure Content Management”, which is incorporated herein by reference in its entirety. It can be implemented using a global Secure Content Management (SCM) infrastructure, as described in filed US patent application Ser. No. 12 / 164,078.

  The endpoint of the network connection 215 in the Corponet 223 is a policy enforcement point 226 along with a compliant policy server 230 described in detail below. Corporate resources and data (collectively identified by data 234 in FIG. 2) are available in the Corponet 223, and some rights property that it is desired to protect against theft and malicious attacks, It usually contains sensitive information and / or sensitive information. Corponet 223 may be required to support the IT needs of business or corporate employees such as client computers, workstations, laptops, mobile devices and the like (not shown), etc. Usually organized to support other devices. Other devices may either be deployed locally on the Corponet 223 or in some cases remotely from the Corponet.

  The edge firewall 239 is disposed at a boundary in the corporate network 223 that is set to monitor traffic between a corporate network such as the Internet 242 and an external network. External resources 245 such as email and web servers and databases are normally accessible on the Internet 242.

  The user may create the virtualized environment 200 by loading the user's desktop image 250 from the portable storage media 253 such as the USB drive shown to the host machine 210. Portable storage media 253 may include virtualization software 116 in some cases. When the desktop image 250 is transferred to the child partition and the virtualization software is operational, the guest machine 205 is instantiated on the host machine 210 and includes the desktop, application, data, settings and priority on the host. Virtualize the user's computer. Note that the particular mix of objects (ie applications, data, etc.) that are virtualized on the guest machine 205 can vary from implementation to implementation, and not all objects need to be virtualized by their implementation.

  The host machine 210 is usually located remotely from the Corponet 223 and is often not closely controlled or monitored as one of the Corponet from a security perspective, a publicly accessible PC such as a kiosk, library, or home-based May include a computer. As a result, malware (indicated by reference numeral 252) can infect a host machine that has the potential for guest machine 205 compromise.

  As shown in FIG. 3, to address malware threats on the host machine 210, the host health agent 305 is configured to run on the host and checks the host's conformance to the compliance policy 308. . Compliance policy 308 may be stored locally on guest machine 205 when initially initialized on a child partition in some implementations, or otherwise from compliance policy server 230 (FIG. 2). May be taken out. The compliance policy 308 will typically specify the minimum acceptable health condition for the host machine 210. Such conditions can vary depending on the implementation, or can be set by a security administrator. For example, the compliance policy 308 may specify that the host machine 210 is patched with the latest security update and protected by an antivirus product or service. While a single policy is used illustratively in this example, in some applications multiple compliance policies may be utilized.

  The host health agent 305 and locally stored compliance policies are stored on the portable storage media 253 (FIG. 2) and can be transferred to each of the host and guest machines during initialization. In some implementations, the host health agent 305 may be one of a NAP client or other component or agent that may run on the host machine 210 or otherwise include similar NAP functionality. May be implemented as a part.

  The host health agent 305 may, for example, check the status of a security patch (the term “status” means what and when the last patch was installed), the presence of anti-virus and / or anti-malware software, The presence of a malware signature update, a specified certificate / file / registration key to indicate that the host machine is authenticated to run the guest machine (eg the host machine is a corporate or corporate IT asset) You can examine various factors that indicate the health of the host machine, including the presence of firewalls, the presence of properly configured software firewalls, and so on. Note that the elements listed here are intended to be exemplary and other elements required to meet the needs of a particular implementation may be utilized.

  The host health agent 305 is further configured to communicate with a corresponding guest health agent 312 that is a component of the guest machine 205. In particular, the host health agent 305 may generate a compliant declaration 320 indicating the health of the host machine after the host health agent has performed the inspection. The compliance declaration 320 may be sent by the host health agent 305 to the guest health agent 312 in response to a request from the guest health agent, for example. Optionally, the host health agent 305 can send a compliance declaration 320 at its initiative on the occurrence of another trigger or condition or at a predetermined time.

  The host health agent 305 may be configured to send a compliance declaration 320 to the compliance policy server 230 (or policy enforcement point 226) on behalf of the guest health agent 312. In this case, the compliance policy server 230 can confirm the compliance declaration 320. If the host machine 210 is found to be compliant with applicable policies, the compliance policy server 230 can issue a signed health certificate 322 to the host health agent 305. When the host health agent 305 receives a request from the guest health agent 312, it can send a signed health certificate 322 to the guest health agent.

  The guest health agent 312 uses the locally compliant declaration 320 (or signed health certificate 322) to determine if there is a secure virtualization environment that the guest machine 205 can operate on. Can do. Further, when the guest machine 205 accesses an external network or corporate network 223 (FIG. 2), the guest machine 205 can forward the compliance declaration 320 (or signed health certificate 322) to the policy enforcement point 226. Each of these applications is further illustrated in the application scenarios shown in the flowcharts in FIGS. 4 and 5 below. The flowchart refers to the elements shown in FIGS. 2 and 3 and is described in the accompanying text.

  FIG. 4 is a flowchart of a first exemplary usage scenario 400 in which the host health agent 305 checks the health of the host machine 210 at several points in the startup or initialization process of the guest machine 205 on the host. Is shown. For example, on an unknown host machine that can be located in a public place such as a library, kiosk or cyber cafe, a test can be performed each time a user attempts to start the desktop image 250 as a guest machine. At the point at which the guest health agent 312 starts (415), the scenario 400 begins when the guest machine 205 starts the boot process (referenced by reference numeral 410).

  The guest health agent 312 may request the host health agent 305 to inspect the health of the host machine 210 (420) to ensure compliance with the host policy 308. As mentioned above, the specific elements examined and the requirements imposed by policy 308 can vary from implementation to implementation. The host health agent 305 performs a health check to be responsive to the request (425) and provides a compliant declaration 320 to the guest health agent 312 (430). Alternatively, as described above, the host health agent 305 provides a compliance declaration 320 to the compliance policy server 230 and is signed if it is determined that the host machine 210 is compliant with applicable policies. Return and receive the health certificate 322.

  The guest health agent 312 compares the compliance declaration 320 received from the host health agent 305 with the compliance policy 308 (435). If it is determined (at decision block 440) that the host machine 210 is compliant (or indicates that the signed health certificate 322 is compliant), the guest machine 205 continues its activation process through the results. Is allowed (445). As a result, the virtual environment 200 can be created, so that one or more of the user's desktop, application, setting, priority, data, and the like are provided on the guest machine 205 (406).

  If the guest health agent does not exist on the host machine, or the comparison of the compliance declaration 320 to the policy 308 indicates that the host machine 210 does not comply with the policy, an error message is executed on the guest machine 205. May be displayed via a user interface (450). The error message can provide detailed notification that the host machine 210 is not compliant, so the user can attempt to correct the problem on the host. For example, if the host machine 210 misses a critical security patch, the user may download and install the patch to bring the host into compliance with policy 308. Once so modified, the guest machine 205 can continue the boot process (455) so a virtualized environment is created for the user (460).

  FIG. 5 shows a flowchart of a second exemplary usage scenario 500 in which the host health agent 305 periodically checks the health of the host machine 210. In this example, this check is performed (505) when the guest machine 205 attempts to access an external network such as the Corponet 223.

  When the policy enforcement point 226 confirms the attempt at the network connection 215, the policy enforcement point 226 requests a declaration of compliance created before the connection to the Corponet 223 is completed (510). In response, the guest health agent 312 requests a compliance declaration 320 from the host health agent 305 (515), and the host health agent performs a health check of the host machine 210, thereby generating a compliance declaration. (520). As described above, alternatively, the host health agent 305 provides a compliance declaration 320 to the compliance policy server 230, and if it is determined that the host machine 210 is compliant with an applicable policy, the signature Returned health certificate 322 can be received.

  The guest health agent 312 forwards the declaration 320 compliant with the policy enforcement point 226 (525). Policy enforcement point 226 compares the declarations for applicable compliance policies (530). Typically, applicable policies will be provided by the compliance policy server 230. Further, as described above in the case of locally stored policies 308, one or more policies may be applied to the host machine 210 in a given implementation. If the declaration of compliance from the host health agent 305 (in decision block 535) indicates that the host machine 210 is compliant with applicable policies (or the signed health certificate 322 is compliant). The policy enforcement point 226 allows the guest machine 206 to access the Corponet 223 (540).

  Policy enforcement if the guest health agent is not present on the host machine or the comparison of the compliance declaration 320 against the policy supplied by the compliance policy server 230 indicates that the host machine 210 does not comply with the policy Point 226 denies network access (545) and an error message may be displayed via the user interface running on guest machine 205 (550). Since the error message can give a detailed notification that the host machine 210 is not compliant, the user can attempt to correct a compliance problem on the host. For example, if the host machine 210 misses the latest malware signature update for an antivirus product running on the host, the user can download and install the signature update, Can be brought into compliance. If so modified, guest machine 205 is allowed network access by compliance enforcement point 226 (555) so that users at the guest machine can write to and read from data store 234 and / or the Internet. Base resources 245 can be accessed.

  The host health agent 305 may be used to check the health of the host machine 210 under other environments. For example, if the integrity of the virtualized environment is suspected, the guest health agent can declare health from the host health agent to verify and / or confirm continued compliance with applicable policies. Can be requested. In one illustrative example, a security assessment under the ESAS security model may be received to cause such suspicion.

FIG. 6 shows an exemplary ESAS organization 600 in which a channel 605 is provided to allow security evaluations to be shared among multiple security gateways called endpoints 610 _{1, 2} ,. An ESAS-based security model for enterprise network security, owned by the assignee of the present application, entitled “Enterprise Security Assessment Sharing”, incorporated herein by reference in its entirety, March 14, 2007 In US patent application Ser. No. 11 / 724,061, filed in U.S.A., which provides enhanced detection of security incidents, enables enterprise-wide browsing, and is clear about automatic responses to security incidents. Allows security administrators to define and enforce simple, centralized enterprise-wide response policies.

  ESAS relies on a semantic abstraction called security evaluation that allows security related information to be shared between endpoints in an enterprise security environment. In this example, the enterprise security environment can include both the Corponet 223 (FIG. 2), users, and machines, eg, a distributed organization using the global SCM infrastructure (including guest machines 205 and host machines 210). Support or include.

  Security assessment has a broad contextual meaning to information (ie data in some situations) that is collected about objects of interest in the environment as a whole, such as computers, users, services, websites, data or businesses. Contextual meaning) defined as a provisional assignment by the endpoint. Security assessments indicate that objects in the environment will be in a specific assessment category such as “compromise” or “under attack” along with the severity of the detected accident (eg, low, medium, high, critical). Use a concise vocabulary for endpoints to clarify.

  The security evaluation is tentative because there are some uncertainties and it is valid for a limited time. The tentative nature of the security evaluation reflects a trust domain that represents the level of trust the endpoint has in assigning contextual meaning, and an estimate of the endpoint for the time period in which the security evaluation is expected to be effective Reflected in two of the components, which are TTL (time-to-live) fields. Thus, for example, given the current understanding of one or more security incident endpoints, a particular machine is compromised with a critical level of severity and an intermediate credit rating, and a TTL of 30 minutes Security assessment may be used by endpoints to clarify

  Various types of security assessments can be utilized in any given enterprise network environment. These may include, for example, various combinations of rating categories and object types.

  ESAS usually offer many advantages. By employing a security assessment with a concise vocabulary, the complexity of the entire data in the enterprise is greatly reduced and only meaningful information is shared between endpoints. The use of security assessments also eliminates the need to collect large amounts of raw data in a central storage location, thereby enabling a highly scalable enterprise security solution to be built on a cost-effective basis. In addition, new endpoints can be easily deployed with on-demand scalability. Security ratings can be shared between new and existing endpoints without having to reconfigure any response policy within the existing endpoint. The new endpoint simply serves as a new source of security evaluation, using the semantic abstraction that the existing endpoint has already understood. Through the use of security assessments, enterprise-wide security policies can also be set up using a very compact and obvious methodology without having to understand all of the security events that each endpoint may create within the enterprise. And then try to explain each action for each event.

  Under the ESAS security model, corporate network users are subject to security policies that govern the use of IT assets in the corporate environment. In particular, the security policy is typically enforced at least in part by the endpoint 610. Security policies typically govern audit practices, etc. within an enterprise, what information a user may access, what types of information may be accessed, and when acceptable and unacceptable behavior is.

For example, endpoint 610 may include a security product that monitors, evaluates, and acts on different portions of security-related data within the enterprise. For example, as shown in FIG. 6, the Corponet 223 includes an edge firefall product 610 ₁ , one or more specialized line-of-business security gateway products 610 ₂ , and a host security product 610 _N. A combination of security products may be used. While not utilized in this particular illustrative example, other types of security products are also available, such as NIDS (Network Intrusion Detection System) products, UTM (Unified Thread), including business security gateways, information leak protection gateways, web application protection products, etc. Management / Security Incident Management) products, SEM / SIM (Security Event Management / Security Incident Management) products, NAP products, and available health monitoring and configuration management products (for example, Microsoft Windows (R) update services ) May be used depending on the specific implementation needs.

  Edgefire Fall is a security product that is organized to protect Corponet 223 from Internet-based threats, while providing users with remote access to applications and data. For example, the edge fire fall can be realized by a Microsoft ISA (Internet Security an Acceleration) (registered trademark) server. Business security products protect various business applications, including e-mail applications such as Microsoft Exchange®, used in Corponet 223 to provide antivirus and anti-spam protection To do. A commercial example of a host security product is Microsoft's TMG (Threat Management Gateway) product, which provides centralized malware protection for corporate desktop, laptop and server operating systems.

  In the most typical ESAS implementations, a specialized endpoint called ESAS central server 616 may also be utilized. The ESAS central server 616 is connected to the security assessment channel 605 by logging all security assessment registrations, security assessment logging, and also local actions taken by the endpoint 610 in response to security incidents in the environment. Act as a centralized accounting point. The ESAS central server 616 provides the administrator with a comprehensive view of the entire endpoint 610 and as a whole the history and current state of the enterprise. The use of security assessments allows administrators to set compact and efficient response policies for incidents detected across the enterprise. Security assessments act as natural anchors or starting points to define enterprise-wide security response policies. A simplified and consistent management interface can thus define a desired response for each type of security assessment across the enterprise.

  Endpoint 610 further implements functionality for issuing security assessments on security assessment channels operating in this environment, while registering with a subset of available security assessments issued by other endpoints. The security assessment that exists in this environment that is active (ie, has a TTL indicating that the assessment is still valid) gives such end focus 610 a new way to view its locally available information. Serves to provide a security context.

  That is, the security context allows endpoints 610 to be received from a variety of different sources and to combine or correlate evidence from security assessments across object types to greatly enhance the quality of detection of potential security incidents. To. The endpoint 610 then has local actions or responses for each type of security evaluation (either received from another endpoint or generated internally by the endpoint itself) according to a set of response policies. Make a determination as to whether it is appropriate. Incident detection is an enterprise-wide information in the form of a security assessment, without the burden of sharing a large amount of raw data through the enterprise (mostly completely inappropriate due to lack of any context) Are both efficient and cost effective. The endpoint 610 is further organized to roll back the local action upon expiration of the security evaluation that promoted the local action (ie, the security evaluation exceeds the expiration date specified in the TTL field).

  In this illustrative example, guest machine 205 is also configured as a registrant to a security assessment received on security assessment channel 605 that identifies a security incident involving host machine 210. Thus, the security assessment channel 605 may be extended virtually and logically to the guest machine, for example through a VPN / SSL connection or using global SCM access.

FIG. 7 illustrates an example scenario 700 that may be used to trigger a check of the host machine's compliance with policies to which a security assessment is applicable. Scenario 700 can be described in four stages. As indicated by reference numeral 710, the most likely explanation for the behavior of the host is creating too many connections to the Internet 242 where there is a security breach, so the edgefire fall 610 ₁ could potentially be First show that it is infringed.

Second, the edgefire fall 610 ₁ suspects that the host machine will be “breached” with high severity and high trust, as indicated by reference numeral 720, on the security evaluation channel 605 for registering with the endpoint 610. Send a security rating indicating. Third, since guest machine 205 is a registrant for security evaluation involving the host, it will receive security evaluation 720 on security evaluation channel 605. Security rating 720 suspects that the root partition on the host machine contains malware that creates connections for malicious purposes. If such a suspicion is confirmed, the virtualization environment may be unhealthy and the guest machine 205 may be at risk. Accordingly, the received security assessment 720 can be used to trigger a request from the guest health agent 312 to the host health agent 305 to perform a health check of the host machine 210. The host health agent 305 performs a check to be able to respond to the request and provides a compliant declaration 320 to indicate the result to the guest health agent 312. The declaration of compliance 320 indicates a problem and the user can be notified thereafter so that the correction can be achieved.

Further, in some implementations, registered endpoints 610 _{1, 2,... N} and ESAS central server 616 receiving security rating 720 are identified through the application of their correlation rules and locally available data to trigger actions. Can be used to apply the security view of Endpoint 610 operations can be performed on the guest machine 205, checking whether the guest has been compromised by a security incident detected on the host machine, and verifying that any violation has been corrected and / or healthy. Isolate the guest machine from the Corponet or other IT object until While the actions taken by endpoint 610 may alternatively be applied to host machine 210, in some implementations both guest machine 205 and host machine 210 may be the purpose of the action. Typically, the specific actions taken and IT objects applied are governed by response policies that are set up and implemented in a corporate network or enterprise environment.

As selectively illustrated by reference numeral 740 in FIG. 7, the action taken by endpoint 610 in response to the received security assessment is the security endpoint 610 _{N of} the host performing the on-demand antivirus scan. Is included as an example. Further, as shown, the business security endpoint 610 ₂ may temporarily interrupt instant message (IM) or email traffic. The ESAS central server 616 alerts the security analyst (eg, administrator), also logs security assessments and all actions invoked. These actions are intended as examples and it is emphasized that other actions taken by other endpoints can be utilized to meet the needs of a given implementation and application scenario.

  Although the subject matter has been described in a specific language for structural features and / or methodological operations, the subject matter defined in the appended claims needs to be limited to the specific features or operations described above. It is understood that there is no sex. Furthermore, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims (15)

A method for operating a guest machine (205) created in a child partition (110) operated on a host machine (210),
Initializing boot processing of the guest machine (205) on the child partition (110) of the host machine (210);
Communicating with a root partition (106) on the host machine (210) to determine compliance of the host machine (210) with a compliance policy (308);
When it is determined that the host machine (210) is compliant with the compliance policy (308), the guest machine (205) in the child partition (110) is created to create a virtualized environment (100). Completing the boot process;
Ending the boot process of the guest machine (205) in the child partition (110) when it is determined that the host machine (210) does not comply with the compliance policy (308). A method characterized by that.   The method of claim 1, further comprising utilizing a guest health agent operable on the guest machine for the communication with the root partition.   The method of claim 2, further comprising utilizing a host health agent operable on the root partition of the host machine to communicate with the guest health agent.   The method of claim 3, wherein the host health agent is configured to examine one or more elements indicative of health of the host machine.   The one or more elements include security patch status, presence of anti-virus software, presence of anti-malware software, status of virus signature, status of signature of malware, for the host machine to execute the guest machine 5. The method of claim 4, comprising at least one of the presence of a certificate or file registry key indicating authentication, the presence of a firewall, or the setting state of the firewall.   Receiving instructions stored on a computer readable medium, the host health agent or the guest health agent being implemented when executed by one or more processors located on the host machine 4. The method of claim 3, wherein:   The method of claim 6, wherein the computer readable medium is a storage medium that further includes a desktop image used in the virtualized environment.   The method of claim 7, wherein the desktop image includes one or more of the compliance policy, data, user settings, user preferences, or applications.   i) configuring the guest machine connected to a communication channel in which issuance and registration of security evaluations are operated, each security evaluation being contextual to security incidents associated with objects in the networking environment Configuring the guest machine using a classification that is organized to provide the communication channel is shared among a plurality of security endpoints, and wherein the security assessment is commonly understood by the plurality of endpoints; Ii) receiving a security rating on the communication channel describing a potential security incident on the host machine detected by a security endpoint; and iii) in response to the received security rating, the host Machine hell The method of claim 1 wherein said that further comprising the steps of causing a request to the component on the host machine to perform the inspection.   When it is determined that the host machine is not compliant, the method further includes displaying an error message, indicating that the error message does not comply with the compliance policy of the host machine, and correcting the non-compliance is performed. The method of claim 1, comprising providing notification that there is a possibility of being performed. A method for managing network access from a guest machine (205) running on a child partition (110) of a host machine (210),
Receiving a connection request from the guest machine (205) to the network (223);
Requesting a declaration of conformity (320) indicating the health status of the host machine from the guest machine (205);
Comparing the declaration of compliance (320) against one or more compliance policies that specify minimum health conditions for the host machine (210);
Permit access by the guest machine (205) to the network (223) if the compliance declaration (320) indicates that the host machine (210) complies with the one or more compliance policies. Steps,
Rejecting the request to connect to the network (223) when the compliance declaration (320) indicates that the host machine (210) does not comply with the one or more compliance policies. A method characterized by that.   The method of claim 11, further comprising receiving one or more compliance policies from a compliance policy server.   The method of claim 11, further comprising: allowing access to the network by the guest machine if the non-compliance with one or more compliance policies of the host machine is modified.   The method of claim 13, wherein the remote connection is implemented by one of a VPN, a VPN with SSL, a VPN over IPSec, or a global SCM service.   The compliance declaration is generated by a component running on the root partition of the host machine, which checks the health status of the host machine and returns the compliance declaration to the guest machine If it is organized or it checks the health status of the host machine, returns the compliance declaration to a compliance policy server and determines that the host machine complies with the one or more compliance policies The method of claim 11, wherein the method is organized to receive a signed health declaration from the compliant policy server.

Images